[Devel] [PATCH hci-8.1 v6 04/12] dm-ploop: reject empty deltas

[Alexander Ivanov <alexander.ivanov@virtuozzo.com>]

ploop_delta_check_header() accepts a header with m_Size == 0, and
ploop_add_delta() accepts a raw delta of zero size. The BAT iterators
can't handle nr_be == 0: ploop_bat_clu_to_page_nr(nr_be - 1) wraps to
page 0, so md pages past the first one are iterated whole and the
clu == nr_be - 1 stop condition never matches. A non-raw empty delta
has a single md page, so ploop_apply_delta_mappings() and
notify_delta_merged() (and ploop_check_delta_before_flip() with
PLOOP_DEBUG) walk past it and dereference a NULL d_md on a device with
more than one md page. A raw delta is not handled as raw yet, as
ploop_add_delta() sets is_raw only after applying its mappings; once it
is, an empty raw delta would get all the clusters mapped to it.

Reject empty deltas in ploop_delta_check_header(), which covers every
caller reading a delta header, and in ploop_add_delta() for raw deltas.

https://virtuozzo.atlassian.net/browse/VSTOR-148171
Feature: dm-ploop: ploop target driver

Signed-off-by: Alexander Ivanov <alexander.ivanov@virtuozzo.com>
---
 drivers/md/dm-ploop-bat.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/md/dm-ploop-bat.c b/drivers/md/dm-ploop-bat.c
index 7b12b0f9fe81..4fc99400a0a4 100644
--- a/drivers/md/dm-ploop-bat.c
+++ b/drivers/md/dm-ploop-bat.c
@@ -268,7 +268,7 @@ static int ploop_delta_check_header(struct ploop *ploop,
 	offset_clusters = SEC_TO_CLU(ploop, le32_to_cpu(d_hdr->m_FirstBlockOffset));
 	bat_clusters = ploop_nr_bat_clusters(ploop, delta_nr_be);
 
-	if (delta_nr_be > ploop->nr_bat_entries ||
+	if (!delta_nr_be || delta_nr_be > ploop->nr_bat_entries ||
 	    bat_clusters != offset_clusters)
 		goto out;
 
@@ -503,6 +503,9 @@ int ploop_add_delta(struct ploop *ploop, u32 level, struct file *file, bool is_r
 			goto out;
 	} else {
 		nr_be = POS_TO_CLU(ploop, file_size);
+		ret = -EPROTO;
+		if (!nr_be)
+			goto out;
 	}
 
 	ret = -EBADSLT; /* Lower delta can't be bigger then upper */
-- 
2.53.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel